CVE-2026-5010

Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu

State: Published
Severity: 5.1 Medium
Published: Mar 27, 2026
Updated: Mar 27, 2026
Reserved: Mar 27, 2026

Description

A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on the user’s behalf.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	INCIBE

Weaknesses

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

Affected Products

Product	Versions
ClickeduSanoma	before 5.1Affected 5.1Not affected

References

https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-sanomas-clickedu-0patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.